NCP-ADS cheat sheet

Oversubscription ratio = total downlink bandwidth / total uplink bandwidth in a tier; a 3:1 ratio means hosts can burst to 3x the uplink capacity before contention.

East-west traffic is server-to-server inside the data center; north-south traffic crosses the data center boundary through edge routers and firewalls.

Leaf-spine topology provides equal-cost paths: every leaf connects to every spine, so inter-leaf hops are always 2, keeping latency predictable and bounded.

VLANs segment Layer 2 broadcast domains; inter-VLAN routing requires a Layer 3 device (router, Layer 3 switch, or firewall).

Jumbo frames use MTU 9000 bytes versus the standard 1500; every device on the path, including virtual switches, must match or large packets are dropped.

LACP bundles multiple physical links into one logical link; member links must share the same speed, duplex, and VLAN configuration.

BGP is the standard for data center routing and EVPN-VXLAN control planes; OSPF is common for underlay IP reachability.

VXLAN encapsulates Layer 2 frames in UDP (port 4789) with a 24-bit VNI, supporting about 16 million segments versus VLAN's 4094.

Rack power and cooling planning: a rack exceeding its power budget forces derated capacity; track kW per rack against PDU and cooling capacity before adding nodes.

IOPS, throughput, and latency are independent metrics: random small-block workloads are IOPS-bound, sequential large-block workloads are bandwidth-bound.

RAID 5 usable capacity = (N-1) x disk size; RAID 6 = (N-2) x disk size; RAID 10 = N/2 x disk size with mirroring overhead.

RAID is not a backup: it protects against disk failure only, not deletion, corruption, ransomware, or site loss.

SSD write amplification = bytes written to flash / bytes written by host; over-provisioning and TRIM reduce it.

Thin provisioning presents more logical capacity than physical capacity exists; monitor overcommit ratio and free space to avoid out-of-space events.

Block storage (LUN/volume) is attached to one host or cluster at a time; file storage (NFS/SMB) is shared; object storage is accessed via HTTP API with eventual semantics.

iSCSI runs SCSI commands over TCP typically on port 3260; Fibre Channel uses dedicated HBAs and SAN fabrics with zoning for isolation.

NFSv3 is stateless and uses separate mount and locking protocols; NFSv4 is stateful, uses a single port 2049, and supports integrated locking and ACLs.

Snapshot capacity consumption grows with changed blocks; a long-lived snapshot chain degrades performance and can exhaust the datastore.

RPO = maximum acceptable data loss measured in time; RTO = maximum acceptable time to restore service after an outage.

3-2-1 rule: three copies of data, on two different media, with one copy offsite; an immutable or air-gapped copy defends against ransomware.

Backup types: full copies all data; incremental copies changes since the last backup of any type; differential copies changes since the last full.

Synthetic full backups assemble a new full from the last full plus incrementals without re-reading the production source.

Restore chain length equals the number of incremental backups needed after the base full; longer chains increase RTO and failure risk.

Replication is not backup: it copies deletions and corruption to the replica in near real time.

Snapshot-based backups are crash-consistent by default; application-consistent backups require quiescing via VSS or VMware Tools.

Failover site tiers: hot site (near-zero RTO), warm site (hours), cold site (days); choose tier against the stated RTO.

Backup verification requires periodic test restores; an unverified backup has unknown recoverability and should be treated as no backup.

Type 1 hypervisors run directly on hardware (ESXi, Hyper-V); Type 2 run on a host OS and add latency.

A VM's configured memory, CPU reservations, and shares determine scheduling; unreserved memory can be reclaimed by the hypervisor under contention.

Ballooning reclaims guest memory via a driver; swapping to hypervisor disk is the last resort and causes severe latency.

Overcommitting vCPU is safe for low-utilization workloads; overcommitting memory without reservations risks ballooning and swap.

Live migration requires shared storage or a storage-motion mechanism plus compatible CPU features across hosts in the cluster.

Cloud service models: IaaS provides compute, storage, and network; PaaS adds runtime and managed middleware; SaaS delivers the full application.

Shared responsibility: the provider secures physical and hypervisor layers; the customer secures guest OS, identity, data, and configuration.

Availability zones are isolated failure domains within a region; multi-AZ deployment removes single-datacenter failure as a cause of outage.

Resource quotas and limits are enforced per project or subscription; exceeding a quota blocks provisioning even when capacity exists.

Declarative IaC describes the desired end state; imperative scripts describe steps. Declarative tools converge and are idempotent.

Idempotency means running the same automation repeatedly yields the same result without duplicating resources.

Terraform state maps declared resources to real infrastructure; remote state with locking prevents concurrent applies from corrupting it.

Terraform plan shows the diff between desired and actual; apply executes it; drift is a difference between state and real infrastructure.

Ansible is agentless over SSH or WinRM and executes playbooks of ordered tasks; modules should be idempotent.

Configuration management enforces state on existing hosts (Puppet, Chef, Ansible); provisioning creates hosts (Terraform, cloud templates).

Secrets must never be committed to version control; inject them at runtime from a vault or secret manager.

Pipelines should gate on lint, validate, plan, and policy checks before apply; approval gates protect production changes.

Immutable infrastructure replaces instances rather than patching them in place, eliminating configuration drift.

The USE method checks Utilization, Saturation, and Errors for every resource; the RED method checks Rate, Errors, and Duration for services.

Little's Law: concurrency = arrival rate x latency; rising latency at fixed throughput implies growing queue depth.

Percentile latency (p95, p99) reveals tail behavior hidden by averages; averages mask the slowest requests that users feel.

Four golden signals: latency, traffic, errors, and saturation.

Alert on symptoms (SLO burn, error rate) rather than causes (CPU high) to reduce noise and alert fatigue.

A bottleneck is the single resource limiting throughput; relieving any other resource yields no improvement until it is addressed.

Correlate metrics, logs, and traces by a shared request or trace ID to localize faults across tiers.

Baselines define normal behavior per time of day; alert thresholds set without baselines generate false positives.

Saturation indicators: run-queue length on CPU, disk queue depth, memory swap rate, and network retransmits.